[ISN] Shuttle Columbia's hard drive data recovered from crash site

From: InfoSec News (alerts@private)
Date: Fri May 09 2008 - 05:49:24 PDT


By Brian Fonseca
May 7, 2008

Researchers who extracted data from a hard drive onboard the ill-fated 
space shuttle Columbia say the device was so thoroughly damaged in the 
shuttle's fiery crash that it just looked like a cracked "hunk of metal" 
when it appeared at their door six months later.

Data recovery specialists at Kroll Ontrack Inc. painstakingly retrieved 
99% of the information stored on the charred 400MB Seagate hard drive's 
2.5-in. platters over a two day period after the device was discovered 
six months after the 2003 shuttle crash. The device was found in a dried 
up lake bed along the shuttle's debris area.

The successful retrieval of the data was disclosed in the April, 2008, 
issue of the Physical Review E journal, which published data from tests 
performed by the shuttle astronauts on the critical viscosity of xenon 
gas, according to published reports. The results of the tests were 
stored on the disk and retrieved by Kroll.

The Columbia disintegrated upon re-entry into the Earth's atmosphere on 
Feb. 1, 2003, killing all seven crew members and scattering debris 
across Texas and Louisiana. Investigators determined that a piece of 
foam that became dislodged after launch damaged the ship's thermal 
protection system, leading to an uncontrolled buildup of heat, which 
destroyed the spacecraft.

At the time of the accident, the shuttle was returning from a 16-day 
mission to conduct a variety of atmospheric scientific experiments. One 
of those tests was an experiment for the National Institute of Standards 
and Technology to determine how xenon gas flows in a zero gravity 
environment. Information about that test was discovered intact on the 
damaged drive, said Jon Edwards, a senior clean room engineer at Kroll.

Edwards said the circuit board on the bottom of the drive was "burned 
almost beyond recognition" and that all of its components had fallen 
off. Every piece of plastic on the model ST9385AG hard drive melted, he 
noted, and all the electronic chips inside had burned and come loose.

Edwards said the Seagate hard drive -- which was about eight years old 
in 2003 -- featured much greater fault tolerance and durability than 
current hard drives of similar capacity.

Two other hard drives aboard the Columbia were so severely damaged that 
it was impossible to extract any usable data, he added.

Before recovery could begin, a great deal of dirt and other debris had 
to be cleaned from the storage device. A rubber seal at the top of the 
hard drive was completely burned off enabling dirt and charred elements 
to enter the casing. Everything but the drive's platters were virtually 
unusable, remarked Edwards

"The heads were bent and they were touching where they shouldn't have, 
so we had to carefully cut and bend metal away from the platters to get 
them out without causing more damage," said Edwards.

Once cleaned, the platters were placed into a spare drive and carefully 
aligned with a new motor. Because the original circuit board was 
destroyed, Kroll had to use trial and error to determine which firmware 
was needed for the device.

Although damage to the drive worsened once the team got it up and 
running, the data recovery specialists retrieved 99% of the drive's 
DOS-formatted contents. "It was only a couple hundred megabytes of data, 
which isn't much by today's terms, but the data [the drive] contained 
was very valuable," noted Edwards.

Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com

This archive was generated by hypermail 2.1.3 : Fri May 09 2008 - 06:15:41 PDT